Connect CalDAV Calendar

An account of CalDAV Calendar is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Calendars on any CalDAV server (iCloud, Fastmail, Nextcloud…), connected with an app password: list calendars and events, read, create, change and delete events, under risks zoned by who the attendees are. Not for Google Calendar.

One account is one CalDAV account (a server URL, a username and an app password); each calendar that stores events is a resource. Reads are priced by the length of the time range; writes by whether they create, change or delete an event, and by who the server may notify: attendees inside the company domains, on the allowlist, or outside. Google Calendar is a separate service.

Permissions, presets and tools of this service: CalDAV Calendar plugin.

How to connect

On the instance: Accounts → Connect an account, then pick the service. Most services take a key the person creates at the service and pastes (a token, or for Gmail an app password); nobody declares anything beforehand. A service that signs people in through its own authorization (Miro) needs nothing either: the gateway registers its own client there the first time someone connects. Every instance has its own client: this gateway never uses one shared with another instance.

The way: with a app password pasted by hand

1. Create an app password named "Vaubaan Gateway" at your calendar provider; never use the account password itself.
2. iCloud: at account.apple.com, Sign-In and Security, App-Specific Passwords (two-factor authentication must be on).
3. Fastmail: Settings, Privacy & Security, Manage app passwords, with access to "Calendars (CalDAV)". Nextcloud: Personal settings, Security, Devices & sessions, Create new app password.
4. Type the server URL: https://caldav.icloud.com for iCloud, https://caldav.fastmail.com for Fastmail, https://<your cloud>/remote.php/dav for Nextcloud.
5. For another server, its address is enough when it publishes /.well-known/caldav; otherwise give the CalDAV address it documents.
6. Type the username of the account (iCloud: the Apple Account e-mail; Fastmail: the full address; Nextcloud: the login name) and paste the app password.
7. An app password has no scopes to choose: it opens the whole calendar account, and what an agent may do is decided by the missions of this gateway. Each calendar becomes a resource you can select per mission.
8. Google Calendar cannot be connected here: Google refuses app passwords over CalDAV. Use the Google Calendar service instead.

Where: https://github.com/vaubaan/gateway/blob/main/docs/handbook/providers/caldav.md#where-to-get-an-app-password

What the connect page asks:

• Server URL: iCloud: https://caldav.icloud.com. Fastmail: https://caldav.fastmail.com. Nextcloud: https://<your cloud>/remote.php/dav. https only.
• Username: The sign-in name of the calendar account, often its e-mail address.
• App password (secret): An app password made for this gateway, not the account password. Stored encrypted; never shown again.

The service's documentation: https://github.com/vaubaan/gateway/blob/main/docs/handbook/providers/caldav.md#where-to-get-an-app-password

Disconnecting

Delete the app password named "Vaubaan Gateway" at the calendar provider: iCloud at account.apple.com (Sign-In and Security, App-Specific Passwords), Fastmail under Settings, Privacy & Security, Nextcloud under Personal settings, Security.

Registration notes from the plugin

From the plugin's README, written for the people who create the key.

Credential and resources

Each calendar that stores events is a resource. Its zoning lists — internal_domains, allowlist_domains, allowlist_addresses — are filled by the owner on the account's page; until then, everybody but the account is external.

Last changed 2026-10-27. This page as Markdown: /docs/providers/caldav.md